Improve the TCB Table

[fitzthum]

The docs now have a threat model page that has a table showing how each platform measures the 4 components of the CoCo TCB. You can find it here in the measurement details section. I wasn't really sure about how TDX and SE work for this. Can experts on these platforms please check what I wrote in this table and make sure it is true? @BbolroC @mythi

[BbolroC]

Yes, I will get back to you if I find anything that needs to be changed. Thanks for the documentation. ❤️

[mythi]

Can experts on these platforms please check what I wrote in this table and make sure it is true?

TDX: how detailed we want to be? TDX Module measures TD state and firmware code (TDMR) and firmware configs/data are measured into RTMR0. The rest looks accurate.